CVE-2026-104962 Plane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads)

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/slug/projects/projectid/members/ returns the complete project-member roster, including each member's email address, first and last name, display name, avatar, and role. ProjectMemberPermission gates the...

CVE-2026-104962

The project management tool Plane is vulnerable to an Insecure Direct Object Reference (IDOR) in the ProjectMemberListCreateAPIEndpoint (specifically the GET /api/v1/workspaces/{slug}/projects/{project_id}/members/ endpoint) prior to version 1.4.0 . The root cause is that the ProjectMemberPermiss...